<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>SAST scan report</title>
  <link rel="stylesheet" href="https://unpkg.com/spectre.css/dist/spectre.min.css">
  <link rel="stylesheet" href="https://unpkg.com/spectre.css/dist/spectre-exp.min.css">
  <link rel="stylesheet" href="https://unpkg.com/spectre.css/dist/spectre-icons.min.css">
  <style>
    .divider[data-content] {
      margin: 1.6rem 0;
    }
  </style>
</head>
<body>







<div class="container grid-xl" style="min-height: 90vh;">
  <header class="navbar" style="height: 4rem;">
  <section class="navbar-section">
    <a href="https://www.shiftleft.io" class="navbar-brand"><img width="60px" src="https://avatars3.githubusercontent.com/u/58593322?s=240&v=4" /></a>
    <a href="https://github.com/ShiftLeftSecurity/sast-scan" class="btn ml-1">sast-scan</a>
    <a href="https://github.com/ShiftLeftSecurity/dep-scan" class="btn ml-1">dep-scan</a>
  </section>
  </header>
  <div class="columns">
    <div class="column col-12">
      <div class="hero hero-sm bg-dark">
        <div class="hero-body">
          <h1>SAST scan status <span class="tooltip tooltip-top" data-tooltip="No major issues were found"><i class="text-success icon icon-4x icon-check"></i></span></h1>
          <p>Report from the scan performed on <span class="text-dark chip"><i class="icon icon-time"> </i>&nbsp; 2020-03-15 at 21:47:33</span> for <a class="btn" href="https://github.com/ShiftLeftSecurity/WebGoat">https://github.com/ShiftLeftSecurity/WebGoat</a></p>
        </div>
      </div>
    </div>
  </div>
  <div class="columns col-gapless">
    <div class="column col-6">
      <div class="card">
        <div class="card-header">
          <div class="card-title h4">Repository Details</div>
          <div class="card-subtitle text-gray">https://github.com/ShiftLeftSecurity/WebGoat</div>
        </div>
        <div class="card-body">
          <div class=""><strong>Branch</strong> <span>develop</span></div>
          <div class=""><strong>Commit</strong> <span>2edd84b77e39ae9e20dba319f64c6c9c42f4045e</span></div>
        </div>
      </div>
    </div>
    <div class="column col-6">
      <div class="card">
        <div class="card-header">
          <div class="card-title h4">Invocation Details</div>
          <div class="card-subtitle text-gray">Source code analyzer</div>
        </div>
        <div class="card-body">
          <div class=""><strong>Run Id</strong> <span>85bd11a5-4d71-4bc3-ac78-b47d03762fd2</span></div>
          <div class=""><strong>Directory</strong> <span>file:///Users/guest/work/WebGoat</span></div>
        </div>
      </div>
    </div>
  </div>
  <div class="divider text-center" data-content="Summary"></div>
  <section id="#summary"></section>
  <details class="accordion" open>
    <summary class="accordion-header">
    <i class="icon icon-arrow-right mr-1"></i>
    Executive Summary
  </summary>
    <div class="accordion-body columns col-gapless">
    <div class="column col-12">
        <p>This report was generated by ShiftLeft from the SAST scan invocation on 2020-03-15 at 21:47:33. The scan used the open source tool <span class="text-bold"> Source code analyzer</span> to scan the source code repository <a href="https://github.com/ShiftLeftSecurity/WebGoat" rel="noopener" target="_blank">https://github.com/ShiftLeftSecurity/WebGoat</a>.
        </p>

        <p>
        Below is a summary of the issues identified:
        </p>
        <table class="table">
          <thead>
          <tr>
            <th>Severity</th>
            <th>Count</th>
          </tr>
          </thead>
          <tbody>
          <tr>
            <td><span class="bg-error chip">CRITICAL</span></td>
            <td>0</td>
          </tr><tr>
            <td><span class="bg-warning chip">HIGH</span></td>
            <td>0</td>
          </tr><tr>
            <td><span class="bg-dark chip">MEDIUM</span></td>
            <td>0</td>
          </tr><tr>
            <td><span class="bg-success chip">LOW</span></td>
            <td>92</td>
          </tr><tr>
            <td><span class="bg-total chip">TOTAL</span></td>
            <td>92</td>
          </tr>
          </tbody>
        </table>


      <p>&nbsp;</p>
      <p><i class="icon icon-check icon-2x text-success"></i>&nbsp; Based on this report, the application is certified as ready for deployment to test and production environments. Please refer to the dependency and container scan reports (if available) for additional context.</p>

    </div>
  </div>
  </details>

  <div class="divider text-center" data-content="All"></div>
  <section id="#all_issues"></section>
  <div class="columns col-gapless">
    <div class="column col-12">
      <h3><i class="icon icon-link"></i> All Issues <span class="text-bold">(92)</span></h3>
    </div>
    <div class="column col-12">
      <div class="filter">
        <input type="radio" id="tag-0" class="filter-tag" name="filter-radio" hidden checked>
        <input type="radio" id="tag-1" class="filter-tag" name="filter-radio" hidden>
        <input type="radio" id="tag-2" class="filter-tag" name="filter-radio" hidden>
        <input type="radio" id="tag-3" class="filter-tag" name="filter-radio" hidden>
        <input type="radio" id="tag-4" class="filter-tag" name="filter-radio" hidden>

        <div class="filter-nav">
          <label class="chip" for="tag-0">All (92)</label>
          <label class="chip" for="tag-1">Critical (0)</label>
          <label class="chip" for="tag-2">High (0)</label>
          <label class="chip" for="tag-3">Medium (0)</label>
          <label class="chip" for="tag-4">Low (92)</label>
        </div>
        <div class="filter-body">
          <table class="table">
            <thead>
            <tr>
              <th>Rule</th>
              <th>Severity</th>
              <th>Source location</th>
              <th>Message</th>
            </tr>
            </thead>
            <tbody>




          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebWolfMacro.java#L49"><i class="icon icon-link"></i> WebWolfMacro.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">String.indexOf(char) is faster than String.indexOf(String).</span>
<pre class="code" style="max-width: 40%;"><code>host = request.getHeader("Host");<br/>        int semicolonIndex = host.indexOf(":");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Lesson.java#L35"><i class="icon icon-link"></i> Lesson.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid using redundant field initializer for 'id'.</span>
<pre class="code" style="max-width: 40%;"><code>private static int count = 1;<br/>    private Integer id = null;<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonMenuItem.java#L114"><i class="icon icon-link"></i> LessonMenuItem.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 18 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>public String toString() {<br/>        StringBuilder bldr = new StringBuilder();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonMenuItem.java#L115"><i class="icon icon-link"></i> LessonMenuItem.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 2 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>StringBuilder bldr = new StringBuilder();<br/>        bldr.append("Name: ").append(name).append(" | ");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonMenuItem.java#L115"><i class="icon icon-link"></i> LessonMenuItem.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>StringBuilder bldr = new StringBuilder();<br/>        bldr.append("Name: ").append(name).append(" | ");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonMenuService.java#L81"><i class="icon icon-link"></i> LessonMenuService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>for (Category category : categories) {<br/>            LessonMenuItem categoryItem = new LessonMenuItem();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonMenuService.java#L88"><i class="icon icon-link"></i> LessonMenuService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>for (Lesson lesson : lessons) {<br/>                LessonMenuItem lessonItem = new LessonMenuItem();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonProgressService.java#L62"><i class="icon icon-link"></i> LessonProgressService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>storedAssignment.setPath(lessonAssignment.getPath());<br/>                    result.add(new LessonOverview(storedAssignment, entry.getValue()));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonProgressService.java#L66"><i class="icon icon-link"></i> LessonProgressService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>} else if (lessonAssignment.getName().equals(storedAssignment.getName())) {<br/>                    result.add(new LessonOverview(storedAssignment, entry.getValue()));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/ReportCardService.java#L78"><i class="icon icon-link"></i> ReportCardService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>LessonTracker lessonTracker = userTracker.getLessonTracker(lesson);<br/>            LessonStatistics lessonStatistics = new LessonStatistics();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L39"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 145 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>String showSession(HttpServletRequest request, HttpSession session) {<br/>        StringBuilder sb = new StringBuilder();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L40"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid appending characters as strings in StringBuffer.append.</span>
<pre class="code" style="max-width: 40%;"><code>StringBuilder sb = new StringBuilder();<br/>        sb.append("id").append(" = ").append(session.getId()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L40"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 2 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>StringBuilder sb = new StringBuilder();<br/>        sb.append("id").append(" = ").append(session.getId()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L40"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 3 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>StringBuilder sb = new StringBuilder();<br/>        sb.append("id").append(" = ").append(session.getId()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L40"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>StringBuilder sb = new StringBuilder();<br/>        sb.append("id").append(" = ").append(session.getId()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L41"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid appending characters as strings in StringBuffer.append.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("id").append(" = ").append(session.getId()).append("\n");<br/>        sb.append("created").append(" = ").append(new Date(session.getCreationTime())).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L41"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 3 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("id").append(" = ").append(session.getId()).append("\n");<br/>        sb.append("created").append(" = ").append(new Date(session.getCreationTime())).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L41"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("id").append(" = ").append(session.getId()).append("\n");<br/>        sb.append("created").append(" = ").append(new Date(session.getCreationTime())).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L42"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid appending characters as strings in StringBuffer.append.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("created").append(" = ").append(new Date(session.getCreationTime())).append("\n");<br/>        sb.append("last access").append(" = ").append(new Date(session.getLastAccessedTime())).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L42"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 3 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("created").append(" = ").append(new Date(session.getCreationTime())).append("\n");<br/>        sb.append("last access").append(" = ").append(new Date(session.getLastAccessedTime())).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L42"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("created").append(" = ").append(new Date(session.getCreationTime())).append("\n");<br/>        sb.append("last access").append(" = ").append(new Date(session.getLastAccessedTime())).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L43"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid appending characters as strings in StringBuffer.append.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("last access").append(" = ").append(new Date(session.getLastAccessedTime())).append("\n");<br/>        sb.append("timeout (secs)").append(" = ").append(session.getMaxInactiveInterval()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L43"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 3 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("last access").append(" = ").append(new Date(session.getLastAccessedTime())).append("\n");<br/>        sb.append("timeout (secs)").append(" = ").append(session.getMaxInactiveInterval()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L43"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("last access").append(" = ").append(new Date(session.getLastAccessedTime())).append("\n");<br/>        sb.append("timeout (secs)").append(" = ").append(session.getMaxInactiveInterval()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L44"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid appending characters as strings in StringBuffer.append.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("timeout (secs)").append(" = ").append(session.getMaxInactiveInterval()).append("\n");<br/>        sb.append("session from cookie?").append(" = ").append(request.isRequestedSessionIdFromCookie()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L44"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 3 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("timeout (secs)").append(" = ").append(session.getMaxInactiveInterval()).append("\n");<br/>        sb.append("session from cookie?").append(" = ").append(request.isRequestedSessionIdFromCookie()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L44"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("timeout (secs)").append(" = ").append(session.getMaxInactiveInterval()).append("\n");<br/>        sb.append("session from cookie?").append(" = ").append(request.isRequestedSessionIdFromCookie()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L45"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid appending characters as strings in StringBuffer.append.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("session from cookie?").append(" = ").append(request.isRequestedSessionIdFromCookie()).append("\n");<br/>        sb.append("session from url?").append(" = ").append(request.isRequestedSessionIdFromURL()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L45"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 2 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("session from cookie?").append(" = ").append(request.isRequestedSessionIdFromCookie()).append("\n");<br/>        sb.append("session from url?").append(" = ").append(request.isRequestedSessionIdFromURL()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L45"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("session from cookie?").append(" = ").append(request.isRequestedSessionIdFromCookie()).append("\n");<br/>        sb.append("session from url?").append(" = ").append(request.isRequestedSessionIdFromURL()).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L56"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Do not add empty strings.</span>
<pre class="code" style="max-width: 40%;"><code>for (String attribute : attributes) {<br/>            String value = session.getAttribute(attribute) + "";<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L57"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid appending characters as strings in StringBuffer.append.</span>
<pre class="code" style="max-width: 40%;"><code>String value = session.getAttribute(attribute) + "";<br/>            sb.append(attribute).append(" = ").append(value).append("\n");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/session/LabelDebugger.java#L12"><i class="icon icon-link"></i> LabelDebugger.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid using redundant field initializer for 'enabled'.</span>
<pre class="code" style="max-width: 40%;"><code><br/>    private boolean enabled = false;<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/users/LessonTracker.java#L55"><i class="icon icon-link"></i> LessonTracker.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid using redundant field initializer for 'numberOfAttempts'.</span>
<pre class="code" style="max-width: 40%;"><code>@Getter<br/>    private int numberOfAttempts = 0;<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/users/Scoreboard.java#L41"><i class="icon icon-link"></i> Scoreboard.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>UserTracker userTracker = userTrackerRepository.findByUser(user.getUsername());<br/>            rankings.add(new Ranking(user.getUsername(), challengesSolved(userTracker)));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge7/Assignment7.java#L60"><i class="icon icon-link"></i> Assignment7.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">String.indexOf(char) is faster than String.indexOf(String).</span>
<pre class="code" style="max-width: 40%;"><code>if (StringUtils.hasText(email)) {<br/>            String username = email.substring(0, email.indexOf("@"));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge7/MD5.java#L54"><i class="icon icon-link"></i> MD5.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>try {<br/>                    System.out.println(MD5.getHashString(new File(element)) + " " + element);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge7/MD5.java#L167"><i class="icon icon-link"></i> MD5.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating FileInputStream, FileOutputStream, FileReader, or FileWriter.</span>
<pre class="code" style="max-width: 40%;"><code>public static byte[] getHash(File f) throws IOException {<br/>        InputStream is = new FileInputStream(f);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge7/MD5.java#L182"><i class="icon icon-link"></i> MD5.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating FileInputStream, FileOutputStream, FileReader, or FileWriter.</span>
<pre class="code" style="max-width: 40%;"><code>public static String getHashString(File f) throws IOException {<br/>        InputStream is = new FileInputStream(f);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge7/MD5.java#L524"><i class="icon icon-link"></i> MD5.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid appending characters as strings in StringBuffer.append.</span>
<pre class="code" style="max-width: 40%;"><code>// number to make it two digits.<br/>                buf.append("0");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge8/Assignment8.java#L51"><i class="icon icon-link"></i> Assignment8.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Do not add empty strings.</span>
<pre class="code" style="max-width: 40%;"><code>public ResponseEntity<?> getVotes() {<br/>        return ResponseEntity.ok(votes.entrySet().stream().collect(Collectors.toMap(e -> "" + e.getKey(), e -> e.getValue())));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L63"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating FileInputStream, FileOutputStream, FileReader, or FileWriter.</span>
<pre class="code" style="max-width: 40%;"><code>try {<br/>            FileCopyUtils.copy(classPathResource.getInputStream(), new FileOutputStream(new File(targetDirectory, "employees.xml")));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L76"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating FileInputStream, FileOutputStream, FileReader, or FileWriter.</span>
<pre class="code" style="max-width: 40%;"><code>XPath path = factory.newXPath();<br/>        InputSource inputSource = new InputSource(new FileInputStream(d));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L78"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 145 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code><br/>        StringBuffer sb = new StringBuffer();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L80"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 5 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code><br/>        sb.append("/Employees/Employee/UserID | ");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L80"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code><br/>        sb.append("/Employees/Employee/UserID | ");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L81"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("/Employees/Employee/UserID | ");<br/>        sb.append("/Employees/Employee/FirstName | ");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L82"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("/Employees/Employee/FirstName | ");<br/>        sb.append("/Employees/Employee/LastName | ");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L83"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>sb.append("/Employees/Employee/LastName | ");<br/>        sb.append("/Employees/Employee/SSN | ");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L98"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>if (i % columns == 0) {<br/>                employeeJson = new HashMap<>();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/xss/CrossSiteScriptingLesson1.java#L39"><i class="icon icon-link"></i> CrossSiteScriptingLesson1.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid calling toString() on String objects; this is unnecessary.</span>
<pre class="code" style="max-width: 40%;"><code>public AttackResult completed(@RequestParam String answer_xss_1) {<br/>        if (answer_xss_1.toString().toLowerCase().equals("yes")) {<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/xss/CrossSiteScriptingLesson5a.java#L54"><i class="icon icon-link"></i> CrossSiteScriptingLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 200 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>userSessionData.setValue("xss-reflected1-complete", (Object) "false");<br/>        StringBuffer cart = new StringBuffer();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/xss/CrossSiteScriptingLesson5a.java#L55"><i class="icon icon-link"></i> CrossSiteScriptingLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 2 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>StringBuffer cart = new StringBuffer();<br/>        cart.append("Thank you for shopping at WebGoat. <br />You're support is appreciated<hr />");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/xss/CrossSiteScriptingLesson5a.java#L55"><i class="icon icon-link"></i> CrossSiteScriptingLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>StringBuffer cart = new StringBuffer();<br/>        cart.append("Thank you for shopping at WebGoat. <br />You're support is appreciated<hr />");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/xss/CrossSiteScriptingLesson5a.java#L56"><i class="icon icon-link"></i> CrossSiteScriptingLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 3 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>cart.append("Thank you for shopping at WebGoat. <br />You're support is appreciated<hr />");<br/>        cart.append("<p>We have charged credit card:" + field1 + "<br />");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/xss/CrossSiteScriptingLesson5a.java#L56"><i class="icon icon-link"></i> CrossSiteScriptingLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>cart.append("Thank you for shopping at WebGoat. <br />You're support is appreciated<hr />");<br/>        cart.append("<p>We have charged credit card:" + field1 + "<br />");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/xss/CrossSiteScriptingLesson5a.java#L57"><i class="icon icon-link"></i> CrossSiteScriptingLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>cart.append("<p>We have charged credit card:" + field1 + "<br />");<br/>        cart.append("                             ------------------- <br />");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/xss/CrossSiteScriptingLesson5a.java#L58"><i class="icon icon-link"></i> CrossSiteScriptingLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid concatenating nonliterals in a StringBuffer/StringBuilder constructor or append().</span>
<pre class="code" style="max-width: 40%;"><code>cart.append("                             ------------------- <br />");<br/>        cart.append("                               $" + totalSale);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/CryptoUtil.java#L44"><i class="icon icon-link"></i> CryptoUtil.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Prefer StringBuilder (non-synchronized) or StringBuffer (synchronized) over += for concatenating strings.</span>
<pre class="code" style="max-width: 40%;"><code>String encodedString = "-----BEGIN PRIVATE KEY-----\n";<br/>        encodedString = encodedString+new String(Base64.getEncoder().encode(keyPair.getPrivate().getEncoded()),Charset.forName("UTF-8"))+"\n";<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/CryptoUtil.java#L45"><i class="icon icon-link"></i> CryptoUtil.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Prefer StringBuilder (non-synchronized) or StringBuffer (synchronized) over += for concatenating strings.</span>
<pre class="code" style="max-width: 40%;"><code>encodedString = encodedString+new String(Base64.getEncoder().encode(keyPair.getPrivate().getEncoded()),Charset.forName("UTF-8"))+"\n";<br/>        encodedString = encodedString+"-----END PRIVATE KEY-----\n";<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/insecure_login/InsecureLoginTask.java#L34"><i class="icon icon-link"></i> InsecureLoginTask.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid calling toString() on String objects; this is unnecessary.</span>
<pre class="code" style="max-width: 40%;"><code>public AttackResult completed(@RequestParam String username, @RequestParam String password) {<br/>    	if (username.toString().equals("CaptainJack") && password.toString().equals("BlackPearl")) {<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/insecure_login/InsecureLoginTask.java#L34"><i class="icon icon-link"></i> InsecureLoginTask.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid calling toString() on String objects; this is unnecessary.</span>
<pre class="code" style="max-width: 40%;"><code>public AttackResult completed(@RequestParam String username, @RequestParam String password) {<br/>    	if (username.toString().equals("CaptainJack") && password.toString().equals("BlackPearl")) {<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/votes/Vote.java#L47"><i class="icon icon-link"></i> Vote.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid using redundant field initializer for 'average'.</span>
<pre class="code" style="max-width: 40%;"><code>@JsonView(Views.UserView.class)<br/>    private long average = 0;<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACUsers.java#L59"><i class="icon icon-link"></i> MissingFunctionACUsers.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>for (WebGoatUser user : allUsers) {<br/>            displayUsers.add(new DisplayUser(user));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACUsers.java#L73"><i class="icon icon-link"></i> MissingFunctionACUsers.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>for (WebGoatUser user : allUsers) {<br/>            displayUsers.add(new DisplayUser(user));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/Users.java#L60"><i class="icon icon-link"></i> Users.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>while (results.next()) {<br/>                        HashMap<String, String> userMap = new HashMap<>();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/password_reset/ResetLinkAssignmentForgotPassword.java#L78"><i class="icon icon-link"></i> ResetLinkAssignmentForgotPassword.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">String.indexOf(char) is faster than String.indexOf(String).</span>
<pre class="code" style="max-width: 40%;"><code>private void sendMailToUser(String email, String host, String resetLink) {<br/>        int index = email.indexOf("@");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/password_reset/SimpleMailAssignment.java#L76"><i class="icon icon-link"></i> SimpleMailAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">String.indexOf(char) is faster than String.indexOf(String).</span>
<pre class="code" style="max-width: 40%;"><code>private String extractUsername(String email) {<br/>        int index = email.indexOf("@");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L41"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 415 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>Zxcvbn zxcvbn = new Zxcvbn();<br/>        StringBuffer output = new StringBuffer();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L46"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 2 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code><br/>        output.append("<b>Your Password: *******</b></br>");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L46"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code><br/>        output.append("<b>Your Password: *******</b></br>");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L47"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 2 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>output.append("<b>Your Password: *******</b></br>");<br/>        output.append("<b>Length: </b>" + password.length() + "</br>");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L47"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>output.append("<b>Your Password: *******</b></br>");<br/>        output.append("<b>Length: </b>" + password.length() + "</br>");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L48"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 2 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>output.append("<b>Length: </b>" + password.length() + "</br>");<br/>        output.append("<b>Estimated guesses needed to crack your password: </b>" + df.format(strength.getGuesses()) + "</br>");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L48"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>output.append("<b>Length: </b>" + password.length() + "</br>");<br/>        output.append("<b>Estimated guesses needed to crack your password: </b>" + df.format(strength.getGuesses()) + "</br>");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L57"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid concatenating nonliterals in a StringBuffer/StringBuilder constructor or append().</span>
<pre class="code" style="max-width: 40%;"><code>}<br/>        output.append("<b>Estimated cracking time: </b>" + calculateTime((long) strength.getCrackTimeSeconds().getOnlineNoThrottling10perSecond()));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L59"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid concatenating nonliterals in a StringBuffer/StringBuilder constructor or append().</span>
<pre class="code" style="max-width: 40%;"><code>if (strength.getFeedback().getWarning().length() != 0)<br/>            output.append("</br><b>Warning: </b>" + strength.getFeedback().getWarning());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L67"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called 2 consecutive times with literals. Use a single append with a single combined String.</span>
<pre class="code" style="max-width: 40%;"><code>}<br/>        output.append("<b>Score: </b>" + strength.getScore() + "/5 </br>");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L67"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.</span>
<pre class="code" style="max-width: 40%;"><code>}<br/>        output.append("<b>Score: </b>" + strength.getScore() + "/5 </br>");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java#L68"><i class="icon icon-link"></i> SecurePasswordsAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid concatenating nonliterals in a StringBuffer/StringBuilder constructor or append().</span>
<pre class="code" style="max-width: 40%;"><code>output.append("<b>Score: </b>" + strength.getScore() + "/5 </br>");<br/>        output.append("<b>Estimated cracking time in seconds: </b>" + calculateTime((long) strength.getCrackTimeSeconds().getOnlineNoThrottling10perSecond()));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson4.java#L61"><i class="icon icon-link"></i> SqlInjectionLesson4.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 39 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>ResultSet results = statement.executeQuery("SELECT phone from employees;");<br/>                StringBuffer output = new StringBuffer();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5.java#L46"><i class="icon icon-link"></i> SqlInjectionLesson5.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 39 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>String regex = "(?i)^(grant alter table to [']?unauthorizedUser[']?)(?:[;]?)$";<br/>            StringBuffer output = new StringBuffer();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5a.java#L90"><i class="icon icon-link"></i> SqlInjectionLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 70 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>results.beforeFirst();<br/>        StringBuilder t = new StringBuilder();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java#L99"><i class="icon icon-link"></i> SqlInjectionLesson8.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 78 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>results.beforeFirst();<br/>        StringBuffer table = new StringBuffer();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java#L75"><i class="icon icon-link"></i> Servers.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>while (rs.next()) {<br/>                Server server = new Server(rs.getString(1), rs.getString(2), rs.getString(3), rs.getString(4), rs.getString(5), rs.getString(6));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/SqlInjectionLesson10b.java#L73"><i class="icon icon-link"></i> SqlInjectionLesson10b.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Prefer StringBuilder (non-synchronized) or StringBuffer (synchronized) over += for concatenating strings.</span>
<pre class="code" style="max-width: 40%;"><code>for (Diagnostic d : hasCompiled) {<br/>                    errors += d.getMessage(null) + "<br>";<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/SqlInjectionLesson10b.java#L108"><i class="icon icon-link"></i> SqlInjectionLesson10b.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid using redundant field initializer for 'contents'.</span>
<pre class="code" style="max-width: 40%;"><code>class JavaObjectFromString extends SimpleJavaFileObject {<br/>        private String contents = null;<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/ssrf/SSRFTask1.java#L45"><i class="icon icon-link"></i> SSRFTask1.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 62 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>try {<br/>            StringBuffer html = new StringBuffer();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/ssrf/SSRFTask2.java#L50"><i class="icon icon-link"></i> SSRFTask2.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">StringBuffer constructor is initialized with size 16, but has at least 63 characters appended.</span>
<pre class="code" style="max-width: 40%;"><code>try {<br/>            StringBuffer html = new StringBuffer();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/webwolf-introduction/src/main/java/org/owasp/webgoat/webwolf_introduction/MailAssignment.java#L53"><i class="icon icon-link"></i> MailAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">String.indexOf(char) is faster than String.indexOf(String).</span>
<pre class="code" style="max-width: 40%;"><code>public AttackResult sendEmail(@RequestParam String email) {<br/>        String username = email.substring(0, email.indexOf("@"));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webwolf/src/main/java/org/owasp/webwolf/FileServer.java#L112"><i class="icon icon-link"></i> FileServer.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Avoid instantiating new objects inside loops.</span>
<pre class="code" style="max-width: 40%;"><code>String link = String.format("files/%s/%s", username, file.getName());<br/>                uploadedFiles.add(new UploadedFile(file.getName(), size, link));<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-4" class="filter-item">
            <td>Performance
            </td>
            <td><span class="chip bg-success">LOW</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webwolf/src/main/java/org/owasp/webwolf/mailbox/Email.java#L70"><i class="icon icon-link"></i> Email.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">String.indexOf(char) is faster than String.indexOf(String).</span>
<pre class="code" style="max-width: 40%;"><code>public String getShortSender() {<br/>        return sender.substring(0, sender.indexOf("@"));<br/>
</code>
</pre>
            </td>
          </tr>
        </tbody>
      </table>
        </div>
      </div>
    </div>
  </div>
</div>
<div class="container grid-xl" style="height: 2rem; color: #bcc3ce;">
  <p>Thank you for supporting <a href="https://www.shiftleft.io" target="_blank">ShiftLeft</a></p>
</div>
</body>
</html>
